CVE-2026-102479: Maven/io.vertx/vertx-core vulnerability
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length.
This can be exploited for request smuggling purpose.
The impacted component is io.vertx:vertx-core.
Affected Software
Event History
Frequently Asked Questions
Which Vert.x Core versions are affected?
Affected versions are 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0. The impacted Maven component is io.vertx:vertx-core.
What does an attacker need to exploit this issue?
An attacker needs to send specially crafted HTTP/1.x headers that are canonicalized as well-known headers. For example, Content-Xength may be interpreted as Content-Length, enabling request-smuggling scenarios.
Are applications using HTTP/1.x affected?
The issue is in the Vert.x HTTP/1.x decoder. Exposure therefore applies where the affected vertx-core versions process HTTP/1.x requests.